summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Use api.env.nss_dir instead of paths.IPA_NSSDB_DIRChristian Heimes2016-11-143-8/+4
| | | | | | | | | | ipaclient plugins are now using nss_dir from api.env instead of hard-coded paths.IPA_NSSDB_DIR. Closes: https://fedorahosted.org/freeipa/ticket/6386 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert-request: accept CSRs with extraneous dataFraser Tweedale2016-11-112-3/+6
| | | | | | | | | | | | | | | The cert-request command used to accept CSRs that had extra data surrounding the PEM data, e.g. commentary about the contents of the CSR. Recent commits that switch to using python-cryptography for cert and CSR handling broke this. Our acceptance tests use such CSRs, hence the tests are now failing. To avoid the issue, freshly encode the python-cryptography CertificateSigningRequest object as PEM. This avoids re-using the user-supplied data, in case it has extraneous data. Fixes: https://fedorahosted.org/freeipa/ticket/6472 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dns: check if container exists using ldapiTomas Krizek2016-11-117-58/+15
| | | | | | | | | | | Previously an adhoc connection was established for checking if dns(sec) container exists. A simple or external bind was used. Instead, always connect with ldapi through api.Backend.ldap2. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Provide user hint about IP address in IPA installAbhijeet Kasurde2016-11-111-2/+4
| | | | | | | | | | | With this fix, user will be notified about pressing enter to proceed with IPA installation procedure, if user has provided valid IP address previously. Fixes https://fedorahosted.org/freeipa/ticket/5949 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: migrate client install to the new class hierarchyJan Cholasta2016-11-113-229/+194
| | | | | | | | | Migrate ipa-client-install from the custom script to the new installer class hierarchy classes. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: allow specifying verbosity and console log format in CLIJan Cholasta2016-11-112-6/+20
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: migrate server installers to the new class hierarchyJan Cholasta2016-11-118-910/+258
| | | | | | | | | Migrate ipa-server-install and ipa-replica-install from the old installer classes to the new installer class hierarchy classes. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: introduce installer class hierarchyJan Cholasta2016-11-1113-4/+1332
| | | | | | | | | Add class hierarchy which allows inherting knob definitions between the various client and server install scripts. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: fix subclassing of knob groupsJan Cholasta2016-11-113-17/+12
| | | | | | | | | | Add new @group decorator to declare an installer class as a knob group instead of subclassing Group, so that subclassing the installer does not create duplicates of the original group. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: make knob base declaration explicitJan Cholasta2016-11-111-37/+43
| | | | | | | | | Declare knob bases explicitly using a keyword argument instead of guessing if the type argument is a base or a type of the knob. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: declare knob CLI names using the argparse conventionJan Cholasta2016-11-112-53/+109
| | | | | | | | | | | | | | Replace cli_name, cli_short_name and cli_positional knob arguments with a single cli_names argument, which allows defining one or more CLI names using the argparse convention ("--option" for long option name, "-o" for short option name and "argument" for positional argument name). Also replace cli_aliases with cli_deprecated_names which uses the same convention. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: use standard Python classes to declare knob typesJan Cholasta2016-11-115-13/+96
| | | | | | | | | | | | | | | | | | | Use type(None) rather than bool to define knobs which are represented as command line flags. This allows declaring both "--option" and "--option={0,1}"-style command line options. Use enum.Enum subclasses instead of set literals to declare enumerations. Use typing.List[T] instead of (list, T) to declare lists. (Note that a minimal reimplementation of typing.List is used instead of the Python 2 backport of the typing module due to non-technical reasons.) Use CheckedIPAddress instead of 'ip' and 'ip-local' to declare IP addresses. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: introduce updated knob constructorJan Cholasta2016-11-111-1/+17
| | | | | | | | | Add new knob() knob constructor. Keep the old Knob() constructor for backward compatibility with old code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: simplify CLI option parsingJan Cholasta2016-11-111-96/+69
| | | | | | | | | | | | Let IPAOptionParser handle parsing of its supported types and use an option callback only for unsupported types. Instead of parsing positional arguments manually, parse them using a custom IPAOptionParser instance, reusing the option parsing code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: improve CLI positional argument handlingJan Cholasta2016-11-114-45/+67
| | | | | | | | | | | | | Instead of specifying which knobs should be positional arguments in cli.install_tool(), do it using a flag in knob definition, where the rest of CLI configuration is. As a side effect, the usage string for CLI tools can now be generated automatically. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix CA replica install on DL1Stanislav Laznicka2016-11-111-1/+1
| | | | | | | | | | | | Dogtag requires Directory Manager password for its installation. On Domain Level 1 a special password for Directory Manager is created and used during the installation. However, by importing the real DM password from remote LDAP, we can no longer use the temporary password from the replica installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installutils: remove 'install_service_keytab' functionMartin Babinsky2016-11-111-11/+0
| | | | | | | | | This functionality was merged to Service class and is not longer used anywhere. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* domain-level agnostic keytab retrieval in httpinstanceMartin Babinsky2016-11-112-30/+4
| | | | | | | | | | | | | apache keytab is now retrieved using the same method in both domain levels. The difference lies in the authentication scheme used to retrieve service keytab: * in DL0 passed in DM credentials are used * in DL1 GSSAPI is used https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* installers: restart DS after KDC is configuredMartin Babinsky2016-11-112-0/+8
| | | | | | | | | This is required to enable password extension plugin right away so that services configured later can use it to request keytabs via ipa-getkeytab. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* dsinstance: use keytab retrieval method from parent classMartin Babinsky2016-11-112-21/+3
| | | | | | | | | | DS replica can now use remote API and ipa-getkeytab to create service principal and fetch the keytab in both domain levels. There is no need to use KDC installer to do it. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* use DM credentials to retrieve service keytab only in DLOMartin Babinsky2016-11-111-1/+2
| | | | | | | | | | | | | | | In DL0 directory manager password is bundled in the supplied replica file and the replica installer can use it to authenticate against master when retrieving service keytabs. In DL1, however, DM credentials are generated randomly and used during local DS instance creation. The proper DM password is imported by custodia much later to the process. We must not allow the installer to contact the remote master using this random password since it would fail. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Service: common method for service keytab requestsMartin Babinsky2016-11-111-0/+54
| | | | | | | | | | | Since creation of service principals and keytab retrieval are common operations, Service class should provide means to add service entry to LDAP, retrieve its keytab to designated destination and change the owner to service user. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Turn Kerberos-related properties to Service class membersMartin Babinsky2016-11-119-74/+95
| | | | | | | | | | | | | The Service class now accepts keytab path and service name part of Kerberos principal as members. Kerberos principal is turned into a property computed from service prefix, FQDN and realm. the handling of Kerberos principals and keytabs in service installers was changed to use class members instead of copy-pasted constants. This shall aid in the future refactoring of principal/keytab handling code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Make service user name a class member of ServiceMartin Babinsky2016-11-117-22/+27
| | | | | | | | | This will aid further refactoring of service installers, since the user will be defined only once during parent class initialization. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* service installers: clean up the inheritanceMartin Babinsky2016-11-1111-72/+51
| | | | | | | | | | | | Instead of delegating handling of some parameters like fstore to the parent class, the *Instance installers had the logic copy-pasted in their constructors. Some other members were also moved to the Service class and the parent class constructors in children were fixed to modern standards of initializing parent class in Python. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Offer more general way to check domain level in replicainstallStanislav Laznicka2016-11-111-59/+49
| | | | | | | | | | | | Domain levels 0 and 1 use the same mechanism of checking domain level correctness. Group them together and make it more general should there be more domain levels in the future (although lets hope there won't be). https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use same means of checking replication agreements on both DLsStanislav Laznicka2016-11-111-14/+7
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replicainstall: move common checks to common_check()Stanislav Laznicka2016-11-111-53/+34
| | | | | | | | | | install_check() and promote_check() have some common checks that can be safely moved to common grounds. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Take advantage of the ca/kra code cleanup in replica installationStanislav Laznicka2016-11-111-27/+11
| | | | | | | | | | | | | | The recent cleanup of ca/kra installation code can be used to greatly reduce the number of differences between DL0 and DL1 in replica installation. This change also allows to move Custodia instance creation after Kerberos and httpd instances installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use updated CA certs in replica installationStanislav Laznicka2016-11-111-25/+21
| | | | | | | | | | | | DL0 updated its CA certificate file prior to installing a DS but would not use it for the installation. Update the file on both domain levels and use it to setup DS and HTTP replica instances. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use os.path.join instead of concatenationStanislav Laznicka2016-11-111-2/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove redundant CA cert file existance checkStanislav Laznicka2016-11-111-3/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use host keytab to connect to remote server on DL0Stanislav Laznicka2016-11-111-11/+15
| | | | | | | | | | | | Since host enrollment was implemented in DL0, use the host keytab to connect to remote api and perform certain actions to merge DL1 and DL0 replica install workflows. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Split install_http_certs() into two functionsStanislav Laznicka2016-11-111-5/+12
| | | | | | | | | | | | install_http_certs() was actually installing http service keytab and actually installing certificates after that. Split it into two so that the names of the new functions better reflect what's actually happening. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* First step of merging replica installation of both DLsStanislav Laznicka2016-11-111-177/+120
| | | | | | | | | | | | The installation steps of replica installation on DL0 and DL1 don't differ too much and should be merged. When host enrollment on DL0 is finished, most of the code will be the same. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Properly bootstrap replica promotion apiStanislav Laznicka2016-11-111-10/+6
| | | | | | | | | | Properly bootstrap api in replica promote_check() so that it can be used later in the installation for setting up dns. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move the pki-tomcat restart to cainstance creationStanislav Laznicka2016-11-113-6/+13
| | | | | | | | | | | pki-tomcat would have been restarted in install and replicainstall for backward compatibility reasons. As Dogtag 9 is not supported anymore, we can move this restart only for DL0 replica installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move httpd restart to DNS installationStanislav Laznicka2016-11-114-18/+3
| | | | | | | | | | | | Web service needs restarting after bindinstance is created to pick up changes done to /etc/resolv.conf. This change should be included anytime DNS is installed therefore it makes sense to move it to the common code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: use ldaps for pkispawn in ipa-ca-installJan Cholasta2016-11-112-2/+7
| | | | | | | | | | | | | Commit 822e1bc82af3a6c1556546c4fbe96eeafad45762 undone the fix from commit 276d16775a4ce8af5d39ca8a7bf5bcd638df343f, breaking ipa-ca-install on servers with hardened DS configuration. Put the fix back to make ipa-ca-install work on hardened DS configuration again. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica install: fix DS restart failure during replica promotionJan Cholasta2016-11-111-2/+6
| | | | | | | | | | | | | | Since commit 0914a3aeb778986dea4020ddf8ca550ebef02bad, ipa config file is created before DS certificate is requested, which makes certmonger request the certificate from the local system rather than the remote master. This causes the request to fail, as local httpd is not yet configured at the time of the request. Move ipa config file creation to its original place to fix the issue. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Import just IPAChangeConf instead of the whole moduleStanislav Laznicka2016-11-111-4/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added file permissions option to IPAChangeConf.newConf()Stanislav Laznicka2016-11-113-3/+8
| | | | | | | | | Also added information about why os.chmod is called sometimes after newConf() calls. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix to ipachangeconf docstringsStanislav Laznicka2016-11-111-18/+22
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replicainstall: Unify default.conf file creationStanislav Laznicka2016-11-111-72/+53
| | | | | | | | | | | | In domain level 0, the default.conf file was created using just file operations. Unified this with domain level 1 where IPAChangeConf is used. Also moved the creation of the file to promote_check in DL1. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* client: use correct code for failed uninstallMartin Basti2016-11-111-2/+2
| | | | | | | | | Hardcoded value 1 means CLIENT_INSTALL_ERROR, but this part belongs to uninstallation so it should be CLIENT_UNINSTALL_ERROR https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: use exceptions instead of return statesMartin Basti2016-11-112-91/+109
| | | | | | | | | | | Python has builtin exceptions which can be used very well to handling errors in python instead of returning error states (C style) Exception will allow better client-server integration in future https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move install part to else branchMartin Basti2016-11-111-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move install cleanup from ipa-client-install to moduleMartin Basti2016-11-112-18/+16
| | | | | | | | Cleanup should be part of installation function https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: move clean CCACHE to moduleMartin Basti2016-11-112-5/+10
| | | | | | | | | | According 04b8575c52410bb6d31e0e55f1cf431d7cc9c7c3 cleaning CCACHE is needed after installation. This commit moves this cleanup from ipa-client-install to client.install() function https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client: fix script executionMartin Basti2016-11-111-11/+12
| | | | | | | | | if __name__ == "__main__" should be first instead of try block. We want execute it only when file was executed as script https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 19:31:48 +0000